CVE-2026-32703: OpenProject XSS Vulnerability

CVE-2026-32703 Overview

CVE-2026-32703 is a stored Cross-Site Scripting (XSS) vulnerability in OpenProject, an open-source web-based project management software. The vulnerability exists in the Repositories module, which fails to properly escape filenames displayed from connected repositories. An attacker with push access to a repository can craft commits containing filenames with embedded HTML code, which is then rendered without proper sanitization when other project members view the changeset.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in the browsers of other project members, potentially leading to session hijacking, credential theft, or malicious actions performed on behalf of victims.

Affected Products

• OpenProject versions prior to 16.6.9
• OpenProject versions prior to 17.0.6
• OpenProject versions prior to 17.1.3
• OpenProject version 17.2.0 (fixed in 17.2.1)

Discovery Timeline

• March 18, 2026 - CVE-2026-32703 published to NVD
• March 19, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32703

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the Repositories module's handling of filenames when displaying changesets from connected version control repositories.

When repository commits are displayed in the OpenProject interface, filenames are rendered in the changeset view without adequate HTML encoding. This architectural oversight allows malicious HTML and JavaScript content embedded within filenames to be executed in the context of other users' browser sessions.

The attack requires the attacker to have legitimate push access to a repository integrated with OpenProject. Once a malicious commit is pushed, any project member who views the changeset containing the crafted filename will have the malicious script executed in their browser. This makes it a persistent (stored) XSS attack that affects all users who access the vulnerable page.

Root Cause

The root cause of this vulnerability is insufficient output encoding in the Repositories module. When displaying filenames from repository changesets, the application fails to sanitize or escape HTML special characters. This allows attacker-controlled content (the filename) to break out of its intended context and be interpreted as executable HTML/JavaScript by the browser.

Attack Vector

The attack is executed over the network and requires the attacker to be authenticated with push access to a repository connected to OpenProject. The attack flow proceeds as follows:

1. The attacker creates a file in the repository with a specially crafted filename containing HTML or JavaScript code (e.g., <img src=x onerror=alert(document.cookie)>)
2. The attacker commits and pushes this file to the repository
3. The attacker then deletes the file in a subsequent commit to ensure it appears in the changeset view
4. When any project member accesses the Repositories module and views the changeset containing the malicious filename, the embedded script executes in their browser
5. The attacker can leverage this to steal session tokens, perform actions as the victim, or redirect users to malicious sites

This vulnerability requires user interaction (viewing the affected changeset) and affects the confidentiality and integrity of the user's session without impacting availability.

Detection Methods for CVE-2026-32703

Indicators of Compromise

• Repository commit history containing filenames with HTML tags or JavaScript code patterns
• Unusual filenames containing characters like <script>, <img, onerror=, onclick=, or similar HTML event handlers
• Web server logs showing requests to repository changeset pages followed by unusual external requests
• User reports of unexpected behavior when viewing repository changesets

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor repository commit logs for filenames containing suspicious patterns such as HTML tags or JavaScript event handlers
• Deploy web application firewalls (WAF) with rules to detect XSS patterns in request/response data
• Enable browser-based XSS auditing and logging through appropriate security headers

Monitoring Recommendations

• Review OpenProject access logs for unusual patterns in the Repositories module
• Set up alerts for repository commits containing filenames with special characters or HTML markup
• Monitor for session anomalies that could indicate successful XSS exploitation and session hijacking
• Implement user behavior analytics to detect actions inconsistent with normal user patterns

How to Mitigate CVE-2026-32703

Immediate Actions Required

• Upgrade OpenProject to version 16.6.9, 17.0.6, 17.1.3, or 17.2.1 depending on your current version branch
• Review repository commit history for any suspicious filenames containing HTML or script content
• Implement Content Security Policy headers to mitigate the impact of any unpatched XSS vulnerabilities
• Consider temporarily restricting repository push access to trusted users until the patch is applied

Patch Information

OpenProject has released security patches addressing this vulnerability in versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1. Organizations should upgrade to the appropriate patched version for their deployment branch. The fix implements proper HTML escaping for filenames displayed in the Repositories module changeset view.

For detailed patch information and upgrade instructions, refer to the OpenProject Security Advisory.

Workarounds

• If immediate patching is not possible, disable the Repositories module at the project or instance level until the upgrade can be performed
• Implement strict Content Security Policy headers with script-src 'self' to prevent inline script execution
• Restrict repository push access to a limited set of highly trusted users
• Deploy a web application firewall with XSS detection rules in front of the OpenProject instance

To disable the Repositories module in OpenProject, administrators can navigate to Administration → Modules and disable the repository integration until the patched version is deployed. This eliminates the attack surface entirely at the cost of repository viewing functionality.